SQL Injection Attacks and Defense - 2009

398 Chapter 9 • Platform-Level Defenses
Maintaining an Audit Trail
Maintaining an audit trail of access on application database objects is critical; however,
many applications don’t do this at the database level. Without an audit trail, it is difficult to
know whether the integrity of application data has been maintained given an SQL injection
attack. The server transaction log might provide some detail; however, this log contains
systemwide database transactions, making it hard to track down application-specific transactions.
All stored procedures could be updated to incorporate auditing logic; however, a better solution
is database triggers. You can use triggers to monitor actions performed on application
tables, and you don’t have to modify existing stored procedures to begin taking advantage
of this functionality. Essentially, you can easily add this type of functionality to existing
applications without having to modify any data access code. When using triggers, it’s important
to keep the logic simple to avoid possible performance penalties associated with the additional
code, and to ensure that the trigger logic is written securely to avoid SQL injection within
these objects. Let’s take a closer look at Oracle database triggers to better understand how
triggers can be leveraged to detect possible SQL injection attacks.
Oracle Error Triggers
Oracle offers a feature called database triggers. These triggers can fire databasewide in case of
special events such as the creation of a Data Definition Language (DDL; e.g., DDL trigger)
or a database error (e.g., ERROR trigger). This offers a simple and easy way to detect SQL
injection attempts.
In most cases, SQL injection attempts, at least in the beginning of an attack, will create
error messages such as “ORA-01756 Single quote not properly terminated” or “ORA-
01789 Query block has incorrect number of result columns”. The number of these error
messages is small, and in most cases they are unique to SQL injection attacks, therefore
keeping the number of false positives low.
The following code will find and document SQL injection attempts in an Oracle
database:
-- Purpose: Oracle Database Error Trigger to detect SQL injection Attacks
-- Version: v 0.9
-- Works against: Oracle 9i, 10g and 11g
-- Author: Alexander Kornbrust of Red-Database-Security GmbH
-- must run as user SYS
-- latest version: http://www.red-database-security.com/scripts/oracle_error_
trigger.html
--
-- Create a table containing the error messages
create table system.oraerror (
id NUMBER,